REMARKS 

Claims 1, 7, and 11-14 have been amended to clarify the subject matter regarded as the 
invention. Claims 1-14 remain pending. 

In response to the objection in paragraph 2 of the Office Action to applicants' claim of 
priority, the specification has been amended to delete the claim of priority to U.S. Patent 
Application No. 09/615,697. 

The attached replacement sheets and the corresponding amendments to the specification 
with respect to claim 9 are believed to overcome the objections set forth in the Office Action to 
the drawings. 

The Examiner has rejected claims 1-6, 11, and 13 under 35 USC 102(b) as being 
anticipated by Krawczyk, claims 7, 8, 12, and 14 under 35 USC 102(b) as being anticipated by 
Chess, and claims 9 and 10 under 35 USC 103(a) as being unpatentable over Chess. 

The rejection is respectfully traversed. With respect to claim 1, Krawczyk describes 
breaking a single file signature up into a plurality of pieces, storing the pieces in different 
locations, and later validating a file that purports to be the original file by computing a current 
signature for the file and comparing the computed (current) signature to at least a subset of the 
stored pieces. Krawczyk at 2:40-57 & Figures 3-5. Krawczyk teaches using the same hash 
function to calculate both the previously computed signature (i.e., the one that is broken into a 
plurality of pieces each of which is stored in a different location) and the computed (current) 
signature of the purported file. Krawczyk at 2:40-57 ("genuine document is hashed into a 
fingerprint using a one-way cryptographic hash function" and "the test document is hashed into a 
second fingerprint using the one-way hash function"); 5:20-31 & Fig. 3 ("hasher 2" is used to 
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calculate both the signature stored in the "fingerprinting phase" and the computed signature 
generated in the "verification phase"). By contrast, claim 1 recites comparing a signature 
computed currently for a file being validated with both a "first file signature computed by the 
signature computing function" (i.e., the same function used to calculate the current "computed 
file signature") and a "second file signature previously computed by other than the signature 
computing function" (emphasis added) (i.e., some function other than the function used to 
calculate the "computed file signature" and the "first file signature"). Krawczyk does not 
disclose comparing a currently computed signature with both a first stored signature computed 
using the same function used to compute the currently computed signature and a second 
signature computed independently of the first file signature. 

To further clarify this distinction, claim 1 has been amended to recite that the analysis 
engine is configured to "determine the file is legitimate if the computed signature matches both 
the first file signature and the second file signature; and either identify the file as suspicious or 
subject the file to further analysis if the computed signature does not match the first file 
signature, the second file signature, or both." No such multi-level analysis is performed as 
taught by Krawczyk because Krawczyk does not disclose a "second file signature" computed 
independently of the "first file signature". See Application at page 74, line 1 - page 76, line 18. 
As such, claim 1 is believed to be allowable. 

Claims 2-6 depend from claim 1 and are believed to be allowable for the same reasons 
described above. 

Claim 7 has been amended to depend from claim 1 and is believed to be allowable for the 
same reasons described above. Chess, on which the original rejection of claim 7 was based, does 
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not describe comparing a currently computed signature with two independently computed stored 
signatures for the file. 

Claims 8-10 depend from claim 7 and are believed to be allowable for the same reasons 
described above. 

Claim 1 1 recites a method performed by the system of claim 1 and is believed to be 
allowable for the same reasons described above. 

Claim 12 has been amended to depend from claim 1 1 and is believed to be allowable for 
the same reasons described above. 

Claim 13 recites a computer program product comprising computer instructions for 
performing the method of claim 1 1 and is believed to be allowable for the same reasons 
described above. 

Claim 14 has been amended to depend from claim 13 and is believed to be allowable for 
the same reasons described above. 
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Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 



Respectfully submitted, 



William J. James 
Registration No. 40,661 
V 408-973-2592 
F 408-973-2595 



VAN PELT AND YI, LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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